Claim  Form 
(CPR  Part  8) 


Claimant 

David  Richard  Carroll 

29  Tiffany  Place,  Apartment  IK,  Brooklyn,  New  York,  NY  11231 


Defendant(s) 

(1)  Cambridge  Analytica  Ltd 

(2)  Cambridge  Analytica  (UK)  Ltd 

(3)  SCL  Elections  Ltd 

(4)  SCL  Group  Ltd 


Does  your  claim  include  any  issues  under  the  Human  Rights  Act  1998?  Q  Yes  [x]  No 
Details  of  claim  (see  also  overleaf) 

The  Claimant  seeks  an  Order  under  section  7  of  the  Data  Protection  Act  1998  that  the  Defendants 
be  required  to  comply  in  full  with  his  subject  access  request  of  January  2017. 

Please  find  enclosed  the  Particulars  of  Claim  (as  well  as  an  application  made  for  pre-action 
disclosure  in  respect  of  other  causes  of  action). 


Defendant's  ^  ^  >  i 

name  and  Defendants  names  as  above 

address  55  New  Oxford  Street 

London 

WC1A  IBS 


For  further  details  of  the  courts  www.gov.uk/find-court-tribunal. 

When  corresponding  with  the  Court,  please  address  forms  or  letters  to  the  Manager  and  always  quote  the  claim  number. 
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Claim  no. 


Details  of  claim  (continued) 


Statement  of  Truth 

*)0000©mThe  Claimant  believes)  that  the  facts  stated  in  these  particulars  of  claim  are  true. 
*  I  am  duly  authorised  by  the  claimant  to  sign  this  statement. 

Full  name  Ravi  Naik _ 

Name  of  claimant’s  legal  representative’s  firm  Irvine  Thanvi  Natas 


signed 

mocomoooooooooooocK 

(Legal  representative's  solicitor) 


position  or  office  held  Partner 

(if  signing  on  behalf  of  firm  or  company) 

*delete  as  appropriate 


Irvine  Thanvi  Natas 

36  Whitefriars  Street 

London 

EC4Y  8BQ 

DX:  5430  Stratford 
Fax:  020  8522  7708 


Claimant’s  or  claimant’s  legal  representative’s 
address  to  which  documents  should  be  sent  if 
different  from  overleaf.  If  you  are  prepared  to 
accept  service  by  DX,  fax  or  e-mail,  please  add 
details. 
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Application  notice 

For  help  in  completing  this  form  please  read  the 
notes  for  guidance  form  N244Notes. 


Name  of  court 

High  Court  Of  Justice 

Queen's  Bench  Division 

Royal  Courts  of  Justice 

Claim  no. 

Fee  account  no. 

(if  applicable) 

Help  with  Fees  -  Ref.  no. 

(if  applicable) 

|  H  |W|  F  |-|  |  |  |-|  1  1  1 

Warrant  no. 

(if  applicable) 

Claimant’s  name  (including  ref.) 

David  Richard  Carroll 
(Ref:  RAN/28325) 

Defendant’s  name  (including  ref.) 

(1)  Cambridge  Analytica  Ltd  (2)  Cambridge 
Analytica  (UK)  Ltd  (3)  SCL  Elections  Ltd 
( 4 )  SCL  Group  Ltd 
(Ref:  KK/ 17517 ) 

Date 

16  March  2018 

1 .  What  is  your  name  or,  if  you  are  a  legal  representative,  the  name  of  your  firm? 


Irvine  Thanvi  Natas 

Are  you  a  Q  Claimant 

Defendant 

[~x~|  Legal  Representative 

Other  (please  specify) 

If  you  are  a  legal  representative  whom  do  you  represent? 

Claimant  /  Applicant 

What  order  are  you  asking  the  court  to  make  and  why? 

An  order  for  pre-action  disclosure  in  the 
also  see  the  enclosed  Application  Grounds 

terms  set  out  in  the  draft  Order.  Please 
/  Part  8  Claim. 

4.  Have  you  attached  a  draft  of  the  order  you  are  applying  for? 

5.  How  do  you  want  to  have  this  application  dealt  with? 

6.  How  long  do  you  think  the  hearing  will  last? 

Is  this  time  estimate  agreed  by  all  parties? 

7.  Give  details  of  any  fixed  trial  date  or  period 

8.  What  level  of  Judge  does  your  hearing  need? 

9.  Who  should  be  served  with  this  application? 


[~x~|  Yes  Q  No 


|~x~|  at  a  hearing  Q  without  a  hearing 
j  |  at  a  telephone  hearing 


5  Hours 
j  |  Yes 


Minutes 

|~xj  No 


Defendants 
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9a.  Please  give  the  service  address,  (other  than  details  of  the 
claimant  or  defendant)  of  any  party  named  in  question  9. 


10.  What  information  will  you  be  relying  on,  in  support  of  your  application? 

|~x~|  the  attached  witness  statement 
|~x~|  the  statement  of  case 
|~x~|  the  evidence  set  out  in  the  box  below 
If  necessary,  please  continue  on  a  separate  sheet. 

Please  refer  to  enclosed  Application  Grounds  /  Part  8  Claim,  witness  statements, 
exhibits  and  expert  reports. 

Please  note  that  the  hearing  estimate  at  question  6  of  this  application  is  provided  on 
the  basis  of  the  section  7  Data  Protection  Act  claim  being  heard  together  with  this 
application . 


Statement  of  Truth 

The  applicant  believes  that  the  facts  stated  in  this  section  (and  any  continuation  sheets)  are  true. 

Signed  _  Dated  16  March  2018 

Applicant’s  legal  representative 

Full  name  Ravi  Naik _ 

Name  of  applicant’s  legal  representative’s  firm  Irvine  Thanvi  Natas _ 

Position  or  office  held  Partner  /  Solicitor _ 

(if  signing  on  behalf  of  firm  or  company) 

11.  Signature  and  address  details 

Signed  _  Dated  16  March  2018 _ 

Applicant’s  legal  representative 

Position  or  office  held  Partner  /  Solicitor _ 

(if  signing  on  behalf  of  firm  or  company) 
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Applicant’s  address  to  which  documents  about  this  application  should  be  sent 
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Claim  No.: 


IN  THE  HIGH  COURT  OF  JUSTICE 
QUEEN’S  BENCH  DIVISION 
MEDIA  AND  COMMUNICATIONS  LIST 


BETWEEN: 


DAVID  CARROLL 


Claimant  /  Applicant 


-  and  - 

(1)  CAMBRIDGE  ANALYTICA  LTD 

(2)  CAMBRIDGE  ANALYTICA  (UK)  LTD 

(3)  SCL  ELECTIONS  LTD 

(4)  SCL  GROUP  LTD 

Defendants  /  Respondents 


PART  8  CPR  CLAIM  UNDER  S  7(9)  DATA  PROTECTION  ACT  1998  and 
APPLICATION  FOR  PRE-ACTION  DISCLOSURE 


SUMMARY 

1 .  The  Claimant  /  Applicant  Professor  David  Carroll  (“the  Claimant”),  applies  for  an  order 
requiring  the  Defendants  /  Respondents  (“the  Defendants”)  to: 

a.  Comply  fully  with  his  subject  access  request  made  under  s  7  Data  Protection  Act 
1998  (“DP A”)  -  that  claim  is  brought  under  Part  8  CPR  (“the  s  7  DPA  claim”); 
and/or 

b.  Provide  him  with  pre-action  disclosure  pursuant  to  s  33(2)  Senior  Courts  Act  1981 
and  Part  31.16  CPR  (“the  disclosure  application”). 

2.  The  Defendants  are  commercial  entities  that  create  detailed  profiles  of  individuals  which 
they  sell  to  advertisers,  political  campaigns  and  other  entities,  so  as  to  assist  them  in 
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targeting  their  efforts  to  influence  the  behaviour  of  profiled  individuals.  The  subject  of 
these  detailed  profiles  is  not  informed  that  they  have  been  generated  or  sold  to  third 
parties.  For  individuals  to  confirm  whether  they  have  been  profiled,  what  information  is 
held  on  them,  and  how  it  has  been  used,  they  need  to  rely  on  subject  access  requests 
under  the  DP  A. 

3.  The  Claimant  made  such  a  request.  In  response,  the  Defendants  confirmed  that  the 
Claimant  has,  without  his  knowledge,  been  the  subject  of  their  profiling  activities.  The 
Claimant  was  provided  with  some  of  that  information  as  to  the  data  held  on  him  although 
this  appears  to  be  materially  incomplete. 

4.  In  order  to  be  provided  with  the  full  infonnation  he  is  entitled  to  under  the  DP  A,  the 
Claimant  brings  the  present  s  7  DPA  claim.  In  pre-action  correspondence,  the  Claimant 
has  also  sought  further  information  which  is  essential  for  him  to  detennine  the  legality 
of  the  Defendants’  processing  of  his  data.  The  Defendants  have  failed  to  provide  this  and 
the  Claimant  therefore  also  makes  the  disclosure  application. 

FACTS 

The  parties 

5.  The  Claimant  is  an  Associate  Professor  of  media  design  at  the  Parsons  School  of  Design 
in  New  York,  USA  and  has  particular  experience  in  the  field  of  online  behavioural 
advertising  technologies.  The  Claimant’s  work  encompasses  research  into  how  the  digital 
media  and  marketing  industry  is  able  to  track  user  behaviours  and  how  companies  can 
use  technology  to  “re-identify”  an  individual  from  supposedly  anonymous  data. 

6.  The  Defendants  are  UK-registered  companies  which,  by  their  own  description,  engage 
in  the  business  of  “behavioural  microtargeting ”  -  the  collating  and/or  creating  and  then 
selling  of  data  profiles  of  individuals  which  are  used  for,  inter  alia,  targeted  advertising 
and  political  campaigning. 

7.  The  personal  data  used  to  create  such  individual  profiles  consists  of  infonnation  relating 
to  people’s  personality  traits,  political  beliefs  and  other  deeply  held  personal  habits  and 
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decisions.  The  profiles  prepared  by  Cambridge  Analytica  are  said  to  use  “ up  to  5,000  data 
points  on  over  230  million  American  voters  ...  [to]  build  your  custom  target  audience, 
then  use  this  crucial  information  to  engage,  persuade,  and  motivate  them  to  act.”  1 

8.  There  are  two  companies  registered  on  Companies  House  with  the  name  “Cambridge 
Analytica”:  Cambridge  Analytica  Ltd  (Co.  number:  09154503)  and  Cambridge  Analytica 
(UK)  Ltd  (Co.  number:  09375920).  It  is  unclear  whether  /  how  these  companies  operate 
together.  SCL  Elections  Limited  (Co.  number:  08256225)  is  Cambridge  Analytica  (UK) 
Ltd’s  parent  company.2  The  ultimate  parent  company  is  SCL  Group  Ltd,  also  registered 
in  the  UK  (Co.  number  055 14098). 

9.  Cambridge  Analytica  (as  a  single  entity)  and  SCL  Elections  Ltd  are  registered  with  the 
Information  Commissioner’s  Office  as  data  controllers.  SCL  Group  is  not  so  registered. 

The  Claimant’s  subject  access  request  under  s  7  DPA  (“the  SAR”) 

10.  On  in  or  around  10  January  2017,  Professor  Carroll  submitted  the  SAR  to  Cambridge 
Analytica  (“the  SAR”).  In  doing  so,  he  was  motivated  by  both  academic  and  personal 
interest  in  ascertaining  what  data  the  Defendants  held  on  him  and  how  it  was  being 
processed.  The  SAR  was  submitted  through  the  following  website: 
https://datarequests.cambridgeanalytica.org. 

11.  In  response  to  that  request,  the  Claimant  received  an  email  from  a  “data  compliance” 
email  address  associated  with  SCL  group.  This  infonned  the  Claimant  that  he  was 
“ required  to  submit  the  £10  fee  and  proof  of  ID  directly  to  SCL  Elections  who  is 
Cambridge  Analytica ’s  agent  for  the  purposes  of  DPA  requests.” 

12.  A  substantive  response  was  then  provided  on  27  March  20 17,  under  cover  of  a  letter  from 
“Cambridge  Analytica”.  That  letter  was  signed  by  Julian  Wheatland,  “Group  COO”.  At 


1  Carole  Cadwalladr,  Robert  Mercer:  the  big  data  billionaire  waging  war  on  mainstream  media,  the  Guardian,  26 
February  2017,  available  at:  https://www.theguardian.com/politics/2017/feb/26/robert-mercer-breitbart-war-on- 
media-steve-bannon-donald-trump-nigel-farage 

2  SCL  Elections  Limited  are  registered  with  Companies  House  as  the  Company  with  “significant  control”  over 
Cambridge  Analytica  (UK)  Limited. 


[3] 


A008 


the  time,  Mr  Wheatland  was  a  director  of  SCL  Group  Limited.  Based  on  publicly 
available  infonnation,  Mr  Wheatland  did  not  hold  a  position  at  Cambridge  Analytica. 

13.  On  27  February  2018,  Alexander  Nix,  Cambridge  Analytical  chief  executive,  gave  oral 
evidence  before  the  Digital,  Culture,  Media  and  Sport  Committee.  He  confirmed  that  the 
Defendants  share  data,  stating  that  they:  “ transfer  data  from  Cambridge  Analytica  to 
SCL”3 

14.  In  light  of  the  above,  the  SAR  appears  to  have  been  processed  by  the  Defendants 
collectively. 

The  Defendants’  response  to  the  SAR  (‘‘the  SAR  Response”) 

15.  The  SAR  Response  confirmed  that  the  Defendants  are  data  controllers  for  the  purposes 
of  s  5  DPA,  including  in  respect  of  the  Claimant,  who  is  /  was  a  data  subject  within  the 
meaning  of  s  1  DPA. 

16.  The  SAR  Response  purported  to  provide  the  Claimant  with  “a//  of  the  data  to  which  you 
are  entitled  under  the  DPA,  in  a  Microsoft  Excel  Spreadsheet  (xls).”  The  enclosed  file 
contained: 

a.  A  summary  of  the  Claimant’s  profile; 

b.  Background  data  on  the  Claimant,  including  his  name,  address,  date  of  birth,  and 
US  voter  identification  numbers; 

c.  Data  relating  to  the  Claimant’s  election  returns  for  both  primary  and  general 
elections  from  2000  -  20 14,  including  a  category  titled  “result”  indicating  the  party 
voted  for;  and 

d.  A  political  profile  stating  the  Claimant’s  political  views  on  key  issues,  ranking 
them  by  order  of  importance  to  him,  and  identifying  his  political  and  party 
affiliation  (registered  and  unregistered)  as  well  as  his  likelihood  of  voting. 


3  AtQ688  -Q689 
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17.  Having  considered  the  response,  based  on  his  knowledge  and  experience,  the  Claimant 
was  concerned  that  it  appeared  to  be  incomplete  and  did  not  comply  with  s  7  DPA  in  a 
number  of  material  respects. 

18.  First,  the  underpinning  personal  data  provided  was  insufficient  to  support  the  ‘headline’ 
personal  profile  of  the  Claimant.  The  political  profile  of  the  Claimant  provided  appeared 
to  be  based  on  further  information  about  him  (whether  derived  from  open  or  private 
sources)  that  was  not  provided  as  part  of  the  SAR  Response.  The  limited  factual 
information  disclosed  did  not  provide  sufficient  information  to  give  rise  to  the  “models” 
profiling  the  Claimant’s  political  views.  For  instance,  the  profile  (correctly)  identified 
gun  control  as  a  key  political  issue  for  the  Claimant.  Yet,  given  his  public  profile  and 
general  background,  this  is  an  unusual  priority  issue.  There  was  nothing  in  the  underlying 
data  that  would  have  permitted  the  Defendants  to  identify  this  private  political  view  as  a 
priority  for  the  Claimant. 

19.  Further,  compared  to  the  Defendants’  public  claims  about  the  nature  and  scope  of  their 
profiling  activities,  the  data  provided  appeared  to  be  very  limited.  For  instance,  speaking 
to  the  Financial  Times  in  January  2017,  Alexander  Nix,  Cambridge  Analytical  chief 
executive  stated:  “We  have  a  massive  database  of  4-5,000  data  points  on  every  adult  in 
America”.4  As  outlined  above,  the  First  Defendant’s  website  gives  a  similar  indication  of 
the  scale  of  the  data  held,  stating  that  they  have  “up  to  5,000  data  points  on  over  230 
million  American  voters.”5  The  SAR  Response  did  not  contain  anywhere  near  this 
number  of  data  points  on  the  Claimant. 

20.  Second,  the  SAR  Response  provided  inadequate  information  on  the  purposes  for  which 
the  Claimant’s  data  was  being  processed.  It  contained  only  a  broad  summary  of  the 
purposes  for  which  that  personal  data  is  processed,  including,  for  example,  “audience 
opinion/behaviour  research  and  polling’’  and  “predictive  algorithm  development’’ .  This 
was  insufficient  for  the  Claimant  to  understand  the  actual  purposes  for  which  the 
Defendants  are  processing  his  data. 


4  Gillian  Tett,  Donald  Trump ’s  campaign  shifted  odds  by  making  big  data  personal.  Financial  Times,  26  January 
2017,  available  at:  https://www.ft.com/content/bee3298c-e304-l  le6-9645-c9357a75844a 

5  https://ca-political.com/ca-advantage 
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2 1 .  Third,  the  S AR  Response  failed  to  provide  information  on  the  recipients  to  whom  the 
Claimant’s  personal  data  was  or  may  be  disclosed.  The  Defendants  provided  a  high-level 
summary  of  the  types  of  “clients”  to  which  they  might  disclose  data  (e.g.  “ political 
campaigns ”  and  “ commercial  entities ”)  but  failed  to  indicate  the  actual  organisations 
with  which  his  data  had  been  shared  /  would  be  shared. 

22.  Fourth,  the  SAR  Response  did  not  provide  the  requisite  information  regarding  the 
source(s)  of  the  personal  data.  It  stated  only  that  the  Defendants  had  obtained  the  data 
from  “ reputable  data  vendors ”  or  “ research  partners ”  without  identifying  these  entities. 

23.  In  light  of  the  above  concerns,  the  Claimant  commissioned  two  expert  reports  by 
Professor  Phil  Howard  and  Dr  David  Stillwell.  Both  experts  independently  concluded 
that  the  SAR  Response  was  likely  to  be  incomplete.6 

24.  In  summary: 

a.  Professor  Howard,  of  Oxford  University,  is  a  leading  expert  on  the  impact  of  new 
information  technologies  on  public  life.  His  report  addresses  in  particular  how 
profiling  techniques  such  as  those  employed  by  the  Defendants  are  used  in  political 
campaigning.  Having  analysed  the  material  disclosed  by  the  Defendants  in 
response  to  the  Claimant’s  SAR,  Professor  Howard  concludes  that  “this  profile 
provides  limited  information  on  what  the  Defendants  were  doing,  and  is 
incomplete.’’' 

b.  Dr  Stillwell,  of  Cambridge  University,  is  an  expert  in  big  data  analysis  and  has 
particular  experience  in  the  prediction  of  psychological  traits  from  social  media 
data.  His  report  deals  with  the  way  in  which  (i)  models  can  predict  an  individual’s 
behaviour  and  preferences  on  the  basis  of  a  range  of  data  points  pertaining  to  that 
individual,  (ii)  such  models  are  created  /  operated,  and  (iii)  the  resulting  profile 
information  can  then  be  used  to  influence  the  relevant  individual’s  behaviour.  Dr 
Stillwell  also  considered  the  infonnation  the  Defendants  provided  in  response  to 


6  In  the  alternative,  the  Defendants  marketing  claims  would  be  significantly  inflated  and  at  least  some  of  the 
predictions  made  in  their  profiling  of  the  Claimant  would  amount  to  very  lucky  guesswork. 
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the  Claimant’s  SAR  (along  with  another  similar  response7).  Analysing  it  in  light  of 
his  particular  expertise,  he  reaches  the  same  conclusion  as  Professor  Howard, 
namely  that  the  information  provided  is  likely  to  be  incomplete.  In  particular,  he 
considers  that  some  of  the  Defendants’  key  model  predictions  in  respect  of  the 
Claimant  are  counter-intuitive  and  “ difficult  to  explain  from  the  generic 
demographic  data  given  in  the  subject  access  request ”,  suggesting  that  further  data 
was  used  in  creating  them. 

Pre-action  correspondence  /  the  proposed  claim 

25.  The  Defendants’  failure  to  provide  an  adequate  SAR  Response  was  in  breach  of  s  7  DPA 
(see  paras  40  ff. ,  below). 

26.  Further,  even  the  (incomplete)  SAR  Response  indicated  that  the  Claimant  has  a  claim 
against  the  Defendants  for  breaches  of  the  DPA,  misuse  of  private  information  and/or 
breach  of  confidence.8 

27.  In  light  of  the  above,  on  12  April  2017  the  Claimant  sent  the  Defendants  a  letter  of  claim. 
In  essence,  the  proposed  claim  comprises  the  following: 

a.  The  profile  of  the  Claimant  prepared  and  distributed  by  the  Defendants  relates  to 
his  political  opinions  and  thus  constitutes  sensitive  personal  information  for  the 
purposes  of  s  2  DPA.  To  process  sensitive  personal  data,  at  least  one  of  the 
conditions  in  Schedule  3  DPA  would  have  to  be  met  -  this  is  not  the  case  and  no 
exemptions  apply. 

b.  The  Claimant’s  non-public  political  views  are  his  private  information.  The 
Defendants’  use  of  this  information  took  place  without  his  consent  and  cannot  be 
justified.  It  therefore  amounts  to  misuse  of  private  information. 

7  Dr  Stillwell  was  provided  with  the  subject  access  response  received  by  Professor  David  Columbia  to  assist  him 
in  preparing  his  report.  Professor  David  Golumbia  has  also  provided  his  own  statement  supporting  the  Claimant’s 
claim  and  application  in  the  light  of  his  own  on-going  pre-action  correspondence  with  the  Defendants.  The  subject 
access  response  received  by  Professor  Golumbia  gives  rise  to  the  same  or  similar  concerns  to  those  raised  by  that 
received  by  the  Claimant. 

8  See  Claimant’s  letter  of  claim  of  12  April  2017. 
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c.  The  Defendants  were  or  ought  to  have  been  aware  that  at  least  some  of  the 
information  they  held  on  the  Claimant  was  /  is  confidential  to  him  and  they  had  no 
right  to  pass  this  on  to  third  parties,  giving  rise  to  a  claim  for  breach  of  confidence. 


28.  The  Claimant  requested  that  the  Defendants  disclose  to  him  his  entire  file  in  full, 
including  the  information  specified  in  para  39.1-39. 1 1  of  the  letter  of  claim.  Further,  para 
40  the  Claimant’s  letter  of  claim  requested  clarification  of  the  following 

1.  Our  client  requests  clarification  of  how  his  data  has  been  used  to  create  the 
profile.  For  example,  do  you  re-identify  our  client ’s  data  from  de-identified  / 
anonymised  data  sets?  Further,  do  you  use  probabilistic  and  /  or  deterministic 
methods  in  performing  the  re-identification  of  the  data? 

2.  Please  clarify  the  source  of  the  information  that  gave  rise  to  our  client ’s  entry 
onto  your  database. 

3.  Whether  our  client  is  currently  the  subject  of  a  profile  on  an  SCL  /  Cambridge 
Analytica  database  (in  any  format). 

4.  If  our  client  is  not  the  subject  of  a  current  profile,  whether  he  has  ever  been 
and,  if  so,  for  what  period  of  time? 

5.  Who  has  accessed  the  profile  for  our  client  (in  any  format)  and  when. 

6.  Whether  our  client  has  ever  been  subject  to  any  form  of  bespoke  request. 

29.  The  Defendants  failed  to  provide  any  admissible  response  to  the  letter  of  claim  or  to 
address  the  shortcomings  of  the  SAR  Response.  This  means  that  the  Claimant  lacks 
essential  information  to  assess  the  legality  of  all  relevant  aspects  of  the  processing  of  his 
data. 

30.  In  the  light  of  the  Claimant’s  concerns  about  the  processing  of  his  data,  he  also  needs  to 
understand  the  methodologies  used  by  the  Defendants  in  obtaining  the  data  it  holds  on 
him  and  then  how  it  is  used  to  profile  him.  Accordingly,  he  also  seeks  disclosure  of: 

a.  Internal  documents  or  policies  which  outline  the  Defendants’  data  collection 
practices; 

b.  Internal  documents  or  policies  which  explain  the  methodologies  used  to  process 
the  data  and  /  or  generate  models  or  profiles  on  individuals. 


[8] 


A013 


31.  Therefore,  before  pursuing  his  proposed  claim,  the  Claimant  seeks  an  order  (i) 
compelling  the  Defendants  to  comply  with  their  duties  under  s  7  DPA  by  providing  a  full 
response  to  his  SAR;  and  (ii)  requiring  them  to  provide  advance  disclosure. 


LAW 

The  DPA 

32.  The  DPA  gave  domestic  effect  to  the  provisions  of  Directive  95/46/EC  on  the  protection 
of  individuals  with  regard  to  the  processing  of  personal  data  and  the  free  movement  of 
such  data  (“the  Directive”).  Recital  2  of  the  Directive  states  that  data  processing  systems 
"must,  whatever  the  nationality  or  residence  of  natural  persons,  respect  their 
fundamental  rights  and  freedoms,  notably  the  right  to  privacy..." . 

33.  SI  DPA  contains  the  basic  interpretative  positions.  “ Data  subject ”  is  defined  as  the 
“ individual  who  is  the  subject  of  the  data."  “ Personal  data ”  means: 

data  which  relate  to  a  living  individual  who  can  be  identified — 

(a)  from  those  data,  or 

(b)  from  those  data  and  other  information  which  is  in  the  possession  of,  or 
is  likely  to  come  into  the  possession  of,  the  data  controller, 

and  includes  any  expression  of  opinion  about  the  individual  and  any 
indication  of  the  intentions  of  the  data  controller  or  any  other  person  in 
respect  of  the  individual ... 

34.  S2  DPA  defines  the  term  “ sensitive  personal  data ”  as  including  data  consisting  of 
information  as  to  a  data  subject’s  " political  opinions”,  his  ‘‘religious  beliefs  or  other 
beliefs  of  a  similar  nature .” 

35.  S  5  DPA  establishes  the  scope  of  the  DPA’s  application.  It  provides,  inter  alia,  that:9 


9  Emphasis  added 
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(1)  Except  as  otherwise  provided  by  or  under  section  54,  this  Act  applies  to  a  data 
controller  in  respect  of  any  data  only  if— 

(a)  the  data  controller  is  established  in  the  United  Kingdom  and  the  data  are 
processed  in  the  context  of  that  establishment,  or 

(b)  the  data  controller  is  established  neither  in  the  United  Kingdom  nor  in 
any  other  EEA  State  but  uses  equipment  in  the  United  Kingdom  for 
processing  the  data  other-wise  than  for  the  purposes  of  transit  through  the 
United  Kingdom. 


(1A)  ... 

(2)  A  data  controller  falling  within  subsection  (l)(b)  must  nominate  for  the 
purposes  of  this  Act  a  representative  established  in  the  United  Kingdom. 

(3)  For  the  purposes  of subsections  (1)  and  (2),  each  of  the  following  is  to  be  treated 
as  established  in  the  United  Kingdom — 

(a)  ..., 

(b)  a  body  incorporated  under  the  law  of,  or  of  any  part  of,  the  United 
Kingdom, 


(c)  ... 

(d)  any  person  who  does  not  fall  within  paragraph  (a),  (b)  or  (c)  but 
maintains  in  the  United  Kingdom — 

(i)  an  office,  branch  or  agency  through  which  he  carries  on  any 
activity,  or 

(ii)  a  regular  practice; 

and  the  reference  to  establishment  in  any  other  EEA  State  has  a 
corresponding  meaning. 

36.  S  7(  1)  DPA  provides  for  the  right  of  access  to  personal  data  in  the  following  manner: 10 


Subject  to  the  following  provisions  of  this  section  and  to  sections  8,  9  and  9A,  an 
individual  is  entitled — 


10  Emphasis  added. 
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(a)  to  be  informed  by  any  data  controller  whether  personal  data  of  which  that 
individual  is  the  data  subject  are  being  processed  by  or  on  behalf  of  that  data 
controller, 

(b)  if  that  is  the  case,  to  be  given  by  the  data  controller  a  description  of— 

(i)  the  personal  data  of  which  that  individual  is  the  data  subject, 

(ii)  the  purposes  for  which  they  are  beins  or  are  to  be  processed,  and 

(iii)  the  recipients  or  classes  of  recipients  to  whom  they  are  or  may  be 
disclosed, 

(c)  to  have  communicated  to  him  in  an  intelligible  form — 

(i)  the  information  constituting  any  personal  data  of  which  that  individual  is 
the  data  subject,  and 

(ii)  any  information  available  to  the  data  controller  as  to  the  source  of  those 
data,  and 

(d)  where  the  processing  by  automatic  means  of  personal  data  of  which  that 
individual  is  the  data  subject  for  the  purpose  of  evaluating  matters  relating 
to  him  such  as,  for  example,  his  performance  at  work,  his  credit  worthiness, 
his  reliability  or  his  conduct,  has  constituted  or  is  likely  to  constitute  the  sole 
basis  for  any  decision  significantly  affecting  him,  to  be  informed  by  the  data 
controller  of  the  logic  involved  in  that  decision-taking. 

37.  This  provision  implements  Article  12  of  the  Directive,  which  is  headed  “ Right  of 
access’’.  S  7(9)  DPA  provides  that:  “If  a  court  is  satisfied  on  the  application  of  any 
person  who  has  made  a  request  under  the  foregoing  provisions  of  this  section  that  the 
data  controller  in  question  has  failed  to  comply  with  the  request  in  contravention  of  those 
provisions,  the  court  may  order  him  to  comply  with  the  request.  ’’ 


Pre-action  disclosure 


38.  Under  s  33(2)  Senior  Courts  Act  1981  the  High  Court  has  the  power  to  order  disclosure 
in  the  context  of  preliminary  proceedings.  It  states: 

Powers  of  High  Court  exercisable  before  commencement  of  action 

(2)  On  the  application,  in  accordance  with  rules  of  court,  of  a  person  who  appears 
to  the  High  Court  to  be  likely  to  be  a  party  to  subsequent  proceedings  in  that  court 
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[...]  -  the  High  Court  shall,  in  such  circumstances  as  may  be  specified  in  the  rules, 
have  power  to  order  a  person  who  appears  to  the  court  to  be  likely  to  be  a  party  to 
the  proceedings  and  to  be  likely  to  have  or  to  have  had  in  his  possession  ,  custody 
or  power  any  documents  which  are  relevant  to  an  issue  arising  or  likely  to  arise 
out  of  that  claim — 

(a)  to  disclose  whether  those  documents  are  in  his  possession,  custody  or  power; 
and 

(b)  to  produce  such  of  those  documents  as  are  in  his  possession,  custody  or  power 
to  the  applicant  or,  on  such  conditions  as  may  be  specified  in  the  order — 

(i)  to  the  applicant's  legal  advisers;  or 

(ii)  to  the  applicant's  legal  advisers  and  any  medical  or  other  professional  adviser 
of  the  applicant;  or 

(iii)  if  the  applicant  has  no  legal  adviser,  to  any  medical  or  other  professional 
adviser  of  the  applicant. 

39.  Part  31.16  CPR  states: 

Disclosure  before  proceedings  start 

(1)  This  rule  applies  where  an  application  is  made  to  the  court  under  any  Act  for 
disclosure  before  proceedings  have  started. 

(2)  The  application  must  be  supported  by  evidence. 

(3)  The  court  may  make  an  order  under  this  rule  only  where— 

(a)  the  respondent  is  likely  to  be  a  party  to  subsequent  proceedings; 

(b)  the  applicant  is  also  likely  to  be  a  party  to  those  proceedings; 

(c)  if  proceedings  had  started,  the  respondent’s  duty  by  way  of  standard 
disclosure,  set  out  in  rule  31.6,  would  extend  to  the  documents  or  classes  of 
documents  of  which  the  applicant  seeks  disclosure;  and 

(d)  disclosure  before  proceedings  have  started  is  desirable  in  order  to  - 

(i)  dispose  fairly  of  the  anticipated  proceedings ; 
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(ii)  assist  the  dispute  to  be  resolved  without  proceedings;  or 
(Hi)  save  costs. 

(4)  An  order  under  this  rule  must  - 

(a)  specify  the  documents  or  the  classes  of  documents  which  the  respondent 
must  disclose;  and 

(b)  require  him,  when  making  disclosure,  to  specify  any  of  those  documen  ts  - 

(i)  which  are  no  longer  in  his  control;  or 

(ii)  in  respect  of  which  he  claims  a  right  or  duty  to  withhold  inspection. 

(5)  Such  an  order  may  - 

(a)  require  the  respondent  to  indicate  what  has  happened  to  any  documents 
which  are  no  longer  in  his  control;  and 

(b)  specify  the  time  and  place  for  disclosure  and  inspection. 


THE  S  7  DPA  CLAIM 

40.  The  Defendants  (or  at  least  some  of  the  Defendants)  are  and  were  at  all  material  times 
data  controllers  within  the  meaning  of  s  5  DPA.  The  Defendants  processed  and/or 
continue  to  process  the  Claimant’s  personal  data,  including  sensitive  personal  data, 
within  the  meaning  of  s  1  and  2  DPA. 

41.  The  Claimant  is  and  was  at  all  material  times  a  data  subject  within  the  meaning  of  s  1 
DPA. 

42.  The  Defendants’  failure  to  comply  adequately  with  the  Claimant’s  DPA  request  is 
unlawful  and  in  breach  of  the  Claimant’s  statutory  “right  of  access  to  personal  data”. 

43.  Without  prejudice  to  the  generality  of  the  aforesaid,  the  Claimant  avers  as  follows: 

44.  The  SAR  Response  provide  was  inadequate  and  unlawful  in  that: 
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a.  It  was  materially  incomplete  as  further  data  is  likely  to  have  been  withheld  (see 
paras  18-19,  above),  contrary  to  s  7(l)(c)  DPA; 

b.  It  provided  inadequate  information  on  the  purposes  for  which  the  Claimant’s  data 
was  being  processed  (see  paragraphs  20,  above),  contrary  to  s  7(l)(b)(ii)  DPA; 

c.  It  failed  to  provide  information  on  the  recipients  to  whom  the  Claimant’s  personal 
data  was  or  may  be  disclosed  (see  paragraphs  21,  above)  contrary  to  s  7(l)(b)(iii) 
DPA;  and  /  or 

d.  It  failed  to  provide  any  information  available  regarding  the  source(s)  of  the 
personal  data  (see  paragraphs  22,  above)  contrary  to  s  7(l)(c)(ii)  DPA. 

45.  The  inadequacies  of  the  SAR  Response  set  out  above  are  confirmed  by  the  expert 
evidence  of  Professor  Howard  and  Dr  Stillwell  (see  paras  23-24,  above). 

46.  There  is  no  justification  for  the  Defendants’  failure  to  provide  an  adequate  and  lawful 
response  to  the  SAR. 

THE  DISCLOSURE  APPLICATION 

47.  The  Defendants’  failure  to  comply  with  the  Claimant’s  SAR  means  that  the  Court  will 
need  to  deal  with  the  claim  under  s  7  DPA  in  any  event.  The  Disclosure  Application 
supplements  the  s  7  DPA  claim  in  that  it  requests  further  relevant  information  which, 
while  not  within  the  scope  of  s  7  DPA,  is  essential  for  the  Claimant  to  be  able  to 
understand  the  manner  in  which  the  Defendants  process  his  data  and  the  legality  thereof. 

48.  The  criteria  under  Part  3 1 . 16(3)(a)-(c)  CPR  are  established  in  this  case: 

a.  The  Respondents  are  the  intended  Defendants  in  the  proposed  claim  outlined  at 
para  25  ffi,  above. 

b.  The  Applicant  is  the  intended  Claimant  to  those  proceedings. 
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c.  The  documents  sought  would  need  to  be  disclosed  by  the  Respondents  under 
standard  disclosure  in  the  event  that  such  a  claim  goes  ahead. 

49.  Pre-action  disclosure  is  desirable  within  the  meaning  of  Part  3 1 . 16(3)(d)  for  the  following 
reasons. 

50.  First,  the  Claimant  requires  disclosure  of  any  and  all  information  regarding  the 
processing  of  his  personal  data  by  the  Defendants  in  order  to  be  able  to  ascertain  to  true 
nature  and  scope  of  the  proposed  claim.  The  Claimant  is  also  concerned  to  understand 
who  the  data  was  provided,  to  appreciate  the  full  extent  of  the  processing  and  nature  of 
the  claims  arising. 

5 1 .  Second,  providing  this  disclosure  now,  at  the  pre-action  stage  of  that  claim,  will  avoid 
the  need  for  multiple  costly  and  unnecessary  amendments  in  due  course.  The  key 
information  necessary  for  the  complete  pleading  of  the  claim  is  held  by  the  Defendants. 

52.  Third,  it  is  likely  to  lead  a  narrowing  of  the  issues  between  the  parties,  saving  costs  and 
time,  and  allowing  informed  consideration  of  alternative  dispute  resolution  options. 

53.  Together,  the  above  reasons  mean  that  pre-action  disclosure  is  appropriate  within  the 
meaning  of  Part  31.16  CPR. 

CONCLUSION 

54.  In  light  of  the  above,  the  Court  is  invited  to  make  the  draft  order  prepared  by  the  Claimant 
and  require  the  Defendant  to  (i)  comply  fully  with  his  SAR,  and  (ii)  provide  the  pre¬ 
action  disclosure  sought. 


DINAH  ROSE  QC 
BEN  JAFFEY  QC 
JULIANNE  KERR  MORRISON 
NIKOLAUS  GRUBECK 


Date:  16  March  2018 
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Claim  No.: 


IN  THE  HIGH  COURT  OF  JUSTICE 
QUEEN’S  BENCH  DIVISION 
MEDIA  AND  COMMUNICATIONS  LIST 


BETWEEN: 


DAVID  CARROLL 


Claimant  /  Applicant 


-  and  - 

(1)  CAMBRIDGE  ANALYTICA  LTD 

(2)  CAMBRIDGE  ANALYTICA  (UK)  LTD 

(3)  SCL  ELECTIONS  LTD 

(4)  SCL  GROUP  LTD 

Defendants  /  Respondents 


ORDER 


UPON  the  Claimant’s  claim  pursuant  to  section  7(9)  of  the  Data  Protection  Act  1997  issued  on  16 
March  20 1 8 

AND  UPON  the  Claimant’s  application  for  pre -action  disclosure  pursuant  to  section  33(2)  Senior 
Courts  Act  1981  and  Part  31.16  CPR 

IT  IS  ORDERED  THAT: 

1.  The  Claimant’s  claim  under  section  7(9)  of  the  Data  Protection  Act  1998  is  allowed. 

2.  The  Defendant  must  comply  in  full  with  the  Claimant’s  subject  access  request  made 

under  section  7(1)  of  the  Data  Protection  Act  1998  by  no  later  than  [  ]  2018. 

3.  The  Defendant  must  provide  pre-action  disclosure  of  the  material  specified  in  paras  28 
and  30  of  the  Part  8  Claim  /  Application  for  pre-action  disclosure  dated  16  March  2018. 
That  disclosure  to  be  provided  by  the  same  deadline  as  prescribed  in  para  2  of  this  Order. 
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4.  The  Defendant  shall  pay  the  Claimant’s  costs,  such  costs  to  be  subject  to  detailed 
assessment  on  the  standard  basis  if  not  agreed. 

Dated:  [  ]  2018 
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